Unpatched RCE Found in Code Runner MCP Server

12 May 2026 medium vulnerability technology

CVE-2026-5029 lets unauthenticated attackers execute arbitrary code on Code Runner MCP Server instances running with HTTP transport, and no fix exists.

CERT Polska coordinated disclosure of CVE-2026-5029, a remote code execution vulnerability in the Code Runner MCP Server. When the server is launched with the --transport http option, it exposes an unauthenticated JSON-RPC endpoint (/mcp) on port 3088. Attackers can invoke the server's run-code tool to submit arbitrary source code, which is executed via child_process.exec() using the specified language interpreter, granting code execution with the privileges of the server process.

The vulnerability affects all versions of the project and has not been patched at time of disclosure. Given that MCP (Model Context Protocol) servers are increasingly deployed to support AI-agent tooling and often exposed for integration purposes, unauthenticated instances running HTTP transport are directly exploitable with no user interaction required. No evidence of active in-the-wild exploitation was reported; the advisory represents a coordinated disclosure rather than confirmation of ongoing attacks. Operators are advised to avoid exposing the HTTP transport without authentication controls until an upstream fix is available.

Mentioned in this report

Vulnerabilities CVE-2026-5029

Detection guidance

Code Runner MCP Server Exposed HTTP Transport

ATT&CK T1190

Detects Code Runner MCP Server process launched with --transport http flag, exposing unauthenticated RCE endpoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Code Runner MCP Server Exposed HTTP Transport
description: Detects Code Runner MCP Server launched with --transport http, which
  exposes an unauthenticated JSON-RPC endpoint vulnerable to remote code execution
  (CVE-2026-5029).
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
    - code-runner
    - --transport
    - http
  condition: selection
falsepositives:
- Legitimate development environments intentionally running MCP server on HTTP for
  local testing
- Authorized internal tooling configured with HTTP transport behind network segmentation
level: high
id: 8811f21c-f55f-55a6-9992-527bca1d311d
status: experimental
author: Vorant

Suspicious Child Process Execution from Code Runner MCP Server

ATT&CK T1059

Detects child_process.exec() spawning interpreters (python, node, ruby, bash, etc.) from Code Runner MCP Server process, indicating code execution via the vulnerable run-code tool. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Execution from Code Runner MCP Server
description: Detects language interpreters and shells spawned as children of Code
  Runner MCP Server process, consistent with exploitation of the run-code tool via
  CVE-2026-5029.
tags:
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: code-runner
  selection_child:
    Image|endswith:
    - \\python.exe
    - \\python3.exe
    - \\node.exe
    - \\ruby.exe
    - \\perl.exe
    - \\bash.exe
    - \\cmd.exe
    - \\powershell.exe
    - \\java.exe
    - \\php.exe
  filter_benign:
    ParentCommandLine|contains:
    - test
    - dev
  condition: selection_parent and selection_child and not filter_benign
falsepositives:
- Legitimate MCP server instances running authorized code evaluation in sandboxed
  development environments
- Build or automation systems intentionally using Code Runner MCP as a local task
  executor
level: medium
id: e0ce5947-6857-58ed-90c0-cb33a91352f8
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-5029

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free